Bug 744670

Summary:	import_cluster ACL not enforced.
Product:	Red Hat Enterprise Linux 6	Reporter:	Marius Rieder <marius.rieder>
Component:	luci	Assignee:	Ryan McCabe <rmccabe>
Status:	CLOSED WORKSFORME	QA Contact:	Cluster QE <mspqa-list>
Severity:	high	Docs Contact:
Priority:	medium
Version:	6.2	CC:	cluster-maint
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-10-18 18:56:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Marius Rieder 2011-10-10 05:46:46 UTC

Description of problem:

If a unprivileged user try to import a new cluster, he get a Error 403. However the cluster is created never the less.

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 6.2 Beta (Santiago)
luci-0.23.0-29.el6.x86_64


How reproducible:

Steps to Reproduce:
1. Install cluster suit and luci
2. Create a cluster in luci
3. Delete the cluster in luci
4. Create a new local system user
5. Login to luci as this new user.
6. Import the cluster created before.
  
Actual results:
You get a "Error 403" but the cluster is importer.

Expected results:
You get a "Error 403" instead of the import wizard and the cluster is not imported.

Additional info:

Comment 2 Ryan McCabe 2011-10-12 03:59:14 UTC

I can't reproduce this. When I try to do this, I get the error 403, and the cluster is not added.

Comment 3 RHEL Program Management 2011-10-18 18:40:13 UTC

Since RHEL 6.2 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.

Comment 4 Lon Hohberger 2011-10-18 18:55:39 UTC

I can't reproduce this either; I logged in as a non-root user, clicked 'homebase', then 'manage clusters', clicked 'add cluster', filled the form out, clicked submit and then was presented with:

====
[X] At least one of the following predicates must be met: The current user must be "root", The member must belong to at least one of the following groups: managers, import_cluster

Error 403

We're sorry but we weren't able to process this request.
====

Comment 5 Lon Hohberger 2011-10-18 18:56:57 UTC

[root@snap ~]# rpm -q luci
luci-0.23.0-32.el6.x86_64